File name: | cf9e75cab8d6e3b77258c937554d9b33c3b51395099219925048fda93f2eb261 |
Full analysis: | https://app.any.run/tasks/ccbfbab0-c8fd-4d0d-b684-5a1d89fe4cd2 |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 03:13:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | 2569459D07B891B094E8FE0D3C406F78 |
SHA1: | 6B05A57CC778B3A09C30AFD0F79E483538EBACF7 |
SHA256: | CF9E75CAB8D6E3B77258C937554D9B33C3B51395099219925048FDA93F2EB261 |
SSDEEP: | 98304:A7+g9Kou/+0RxsU1ZhAaJysG635+RiJgs4sQUPjR56x886GAki:2+OG2axDXGkgsJrS6b |
.xlam | | | Excel Macro-enabled Open XML add-in (39.7) |
---|---|---|
.xlsm | | | Excel Microsoft Office Open XML Format document (with Macro) (27.3) |
.xlsx | | | Excel Microsoft Office Open XML Format document (16.1) |
.zip | | | Open Packaging Conventions container (8.3) |
.zan | | | BlueEyes Animation (6.4) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0006 |
ZipCompression: | Deflated |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCRC: | 0x8f93cb55 |
ZipCompressedSize: | 470 |
ZipUncompressedSize: | 1880 |
ZipFileName: | [Content_Types].xml |
TotalEditTime: | - |
---|---|
Application: | Microsoft Excel |
DocSecurity: | None |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: |
|
Company: | - |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 16.03 |
PicturePath: | p:\preview\small |
LastModifiedBy: | Pekárek Milan |
LastPrinted: | 2017:04:20 06:36:51Z |
CreateDate: | 2004:06:02 07:00:40Z |
ModifyDate: | 2019:03:19 10:50:02Z |
Category: | Verze 21.6.2017 |
Title: | - |
---|---|
Creator: | Ladislav Koutník |
Description: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3320 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
1624 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3020 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3244 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3568 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:6402 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
1452 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:6403 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3320 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR906F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3320 | EXCEL.EXE | C:\Users\admin\Desktop\~$cf9e75cab8d6e3b77258c937554d9b33c3b51395099219925048fda93f2eb261.xlam | — | |
MD5:— | SHA256:— | |||
1624 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVREE9D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1624 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Cab763C.tmp | — | |
MD5:— | SHA256:— | |||
1624 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Tar763D.tmp | — | |
MD5:— | SHA256:— | |||
1624 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Cab764E.tmp | — | |
MD5:— | SHA256:— | |||
1624 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Tar764F.tmp | — | |
MD5:— | SHA256:— | |||
1624 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Cab76FC.tmp | — | |
MD5:— | SHA256:— | |||
1624 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Tar76FD.tmp | — | |
MD5:— | SHA256:— | |||
3020 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1624 | EXCEL.EXE | GET | 301 | 212.65.245.203:80 | http://www.vetroplus.cz/produkty/50102101.jpg | CZ | html | 168 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.251:80 | http://www.vetroshop.cz/produkty/50102101.jpg | CZ | html | 256 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.203:80 | http://www.vetroplus.cz/produkty/50102101.jpg | CZ | html | 168 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.203:80 | http://www.vetroplus.cz/produkty/50102101.jpg | CZ | html | 168 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.251:80 | http://www.vetroshop.cz/produkty/50102101.jpg | CZ | html | 256 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.251:80 | http://www.vetroshop.cz/produkty/50102101.jpg | CZ | html | 256 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.203:80 | http://www.vetroplus.cz/produkty/50102101.jpg | CZ | html | 168 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.203:80 | http://www.vetroplus.cz/produkty/50102101.jpg | CZ | html | 168 b | unknown |
1624 | EXCEL.EXE | GET | 301 | 212.65.245.251:80 | http://www.vetroshop.cz/produkty/50102101.jpg | CZ | html | 256 b | unknown |
1624 | EXCEL.EXE | GET | 200 | 2.16.186.81:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | unknown | compressed | 55.2 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1624 | EXCEL.EXE | 212.65.245.251:80 | www.vetroshop.cz | T-Mobile Czech Republic a.s. | CZ | unknown |
1624 | EXCEL.EXE | 2.16.186.81:80 | www.download.windowsupdate.com | Akamai International B.V. | — | whitelisted |
3020 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1624 | EXCEL.EXE | 212.65.245.203:80 | www.vetroplus.cz | T-Mobile Czech Republic a.s. | CZ | unknown |
1624 | EXCEL.EXE | 212.65.245.251:443 | www.vetroshop.cz | T-Mobile Czech Republic a.s. | CZ | unknown |
1624 | EXCEL.EXE | 23.111.11.204:80 | repository.certum.pl | netDNA | US | unknown |
3568 | iexplore.exe | 212.65.245.251:443 | www.vetroshop.cz | T-Mobile Czech Republic a.s. | CZ | unknown |
1452 | iexplore.exe | 212.65.245.251:443 | www.vetroshop.cz | T-Mobile Czech Republic a.s. | CZ | unknown |
3020 | iexplore.exe | 212.65.245.251:443 | www.vetroshop.cz | T-Mobile Czech Republic a.s. | CZ | unknown |
Domain | IP | Reputation |
---|---|---|
www.vetroplus.cz |
| unknown |
www.vetroshop.cz |
| unknown |
repository.certum.pl |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
www.bing.com |
| whitelisted |